# Fabric.io - an app admin can delete team members from other user apps

Fabric.io app admin could delete team members of any other app by tampering account_id and app_id in the DELETE request, causing cross-tenant data loss and DoS.

- Payout: $1,120
- Severity: high
- Program: X / xAI
- Credited: satishb3
- Disclosed: 2015-03-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/43065
- Library page: https://bugbountylibrary.com/r/h1%3A43065
- Tags: domain:web impact:dos impact:integrity kind:bounty platform:hackerone sev:high technique:param-pollution vuln:access-control vuln:business-logic vuln:idor

**Target:** Team member removal endpoint DELETE /accounts/{id}
**Root cause:** The DELETE /accounts/{account_id}?app_id={app_id} endpoint authorized the caller as admin of the app_id in the request but did not verify the account_id belonged to that app, allowing cross-app deletion.
**Steps:**
1. Create VictimApp (Aliceadmin, Alicemember) and HackerApp (Hackeradmin, Hackermember).
2. As Hackeradmin, remove Hackermember via UI and intercept `DELETE /accounts/54aa37d8f61d7749430127ee?admin=true&app_id=54aeafc28bfc55053d000028`.
3. Replace account id and app_id with victim's and drop `admin` param: `DELETE /accounts/54aa4c616bb166b8f300134a?app_id=54ad5e03a25bb8136b000002`.
4. Send request; Alicemember is removed from VictimApp despite Hackeradmin lacking access.
5. Repeat against sole admin to lock the app (DoS).
**How found:** Researcher intercepted the normal team-member removal request, noticed account_id and app_id were both client-supplied, and hypothesized the server trusted app_id for authorization without binding account_id to it.
**Exploitation:** Attacker with admin on any app sends a crafted DELETE with a victim app_id and victim account_id; server deletes the victim team member. Repeating against the last admin leaves the app ownerless and locked out (password reset also fails). Requires knowing victim app_id and account_ids, obtainable from prior membership/logs or by inviting the victim email to leak account id then brute-forcing app_id.
**Escalation:** Chained cross-tenant deletion into DoS by removing the sole admin, locking the victim out of the app entirely.
**Insight:** On multi-tenant SaaS, intercept object-deletion requests and swap the tenant/app identifier alongside the object id; if authorization keys only off one parameter, cross-tenant deletion follows. Also test removing the last admin to convert IDOR into DoS.